A customer with a UCS@school environment tried to rejoin the UCS@school slave.
After rejoin the S4 connector showed several rejects for (?all?) well known
groups. The UCS@school environment has been set up a while ago so the AD
groups do not use the well known RIDs in LDAP.
While syncing the group initially from LDAP to AD the pickle file is rejected due to a constraint violation (objectSID seems to be a single_value attribute but is handled as a multi value attribute).